Security Hardener

By default, the plugin enables:

• File editor disabled
• XML-RPC disabled
• User enumeration blocking
• Generic login errors
• Login rate limiting (5 attempts per 15 minutes)
• Security headers
• WordPress version hiding
• Clean wp_head output
• Security event logging HSTS is disabled by default and should only be enabled if your entire site uses HTTPS.

No. The plugin uses lightweight WordPress hooks and native functions. Security headers add negligible overhead, and rate limiting only checks transients during login attempts.

By default, rate limiting uses REMOTE_ADDR. If behind a trusted proxy, add this to wp-config.php: define('WPSH_TRUSTED_PROXIES', array( '173.245.48.0', // Example: Cloudflare IP range // Add your proxy IPs here )); The plugin will then check HTTP_CF_CONNECTING_IP (Cloudflare) or HTTP_X_FORWARDED_FOR headers.

When security headers are enabled:

• X-Frame-Options: SAMEORIGIN
• X-Content-Type-Options: nosniff
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy: geolocation=(), microphone=(), camera=() When HSTS is enabled (HTTPS only):
• Strict-Transport-Security: max-age=31536000; includeSubDomains (configurable)

Yes. Security headers are sent at the PHP level before caching. However, if you use aggressive server-level caching, you may need to configure your cache to allow these headers through.

Yes, but be careful of conflicts. If another plugin also:

• Sends security headers, you may get duplicates (usually harmless)
• Blocks user enumeration, one should be disabled
• Has login rate limiting, choose one to avoid confusion This plugin is designed to be lightweight and focused on core WordPress hardening.

When you uninstall (not just deactivate) the plugin:

• All plugin settings are deleted
• All security logs are deleted
• All login rate limiting transients are cleared
• Your WordPress installation is returned to its default state Note: Deactivating the plugin preserves all settings.

No. The plugin only secures user-related endpoints by requiring authentication. All other REST API functionality works normally. Public endpoints like oEmbed continue to work.

Failed login blocks expire automatically based on your configured window (default: 15 minutes). Wait for the block period to expire, or:

1. Access your database (phpMyAdmin, etc.)
2. Search for options with _transient_wpsh_login_ in the name
3. Delete those transient options
4. Try logging in again

1. Check Settings > Security Hardener for active features
2. Review the "Recent Security Events" log
3. Use browser dev tools to inspect HTTP headers
4. Try accessing /?author=1 (should return 404 if blocking is enabled)
5. Test failed login attempts to verify rate limiting

Not required, but strongly recommended. HSTS features require HTTPS. For maximum security, your entire site should use HTTPS with a valid SSL certificate.

The plugin is designed for single-site installations. Multisite compatibility has not been tested and is not officially supported at this time.